auth-dydx-exchange-eng-us[.]pages[.]dev

This domain, auth-dydx-exchange-eng-us.pages.dev, is flagged as a high-risk brand impersonation threat targeting dYdX, a decentralized cryptocurrency exchange. The site mimics the legitimate dYdX platform, presenting a page titled 'dYdX Exchange - Decentralized Crypto Trading & DeFi Platform' to deceive users into interacting with fraudulent infrastructure. No explicit crypto drainer kit signatures were identified, but the domain’s design and branding strongly suggest intent to harvest credentials or facilitate unauthorized transactions under the guise of a trusted service.

Infrastructure analysis reveals the domain was registered on October 13, 2025, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.103, hosted on Cloudflare’s network (AS13335). Security vendor detections on VirusTotal stand at 3/95, with one confirmed blocklist entry (PhishDestroy). The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing domains leveraging legitimate CDN providers to evade detection. No Google Safe Browsing (GSB) flags were reported at the time of analysis, though the domain’s low detection rate may reflect its recent deployment or evasion techniques.

As of the latest verification, auth-dydx-exchange-eng-us.pages.dev remains active, posing an ongoing risk to users. Recommended response actions include immediate blacklisting of the domain and IP across security gateways, monitoring for associated wallet addresses or secondary domains linked to this campaign, and notifying affected parties (e.g., dYdX) for brand-level takedown coordination. Given the domain’s use of Cloudflare’s infrastructure, traditional abuse reporting may yield limited results, necessitating layered defenses such as endpoint detection rules and user education on identifying impersonation tactics in decentralized finance (DeFi) contexts.